The PHP2Shell Timeline: 22 Years And A New AI-Assisted Review

🔍 Read the full analysis: The PHP2Shell Timeline: 22 Years And A New AI-Assisted Review on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP shipped fixes on Oct. 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. A report by Thorsten Meyer says researchers at Calif and Wiz pursued related flaws with AI-assisted tools, while the underlying security question reaches back to a 2004 warning about PHP requests interrupted when they hit a memory limit.

The supplied account describes two separate research efforts that converged on a related class of vulnerability. Calif says it found several independent paths to remote code execution on Aug. 1, 2026, reported one flaw to PHP on Aug. 11, supplied a proof of concept on Aug. 14, and received confirmation the next day. It reported a second flaw on Aug. 21. The account says PHP later fixed the two issues, but does not provide the full patch details or affected version ranges.

Wiz Research worked in parallel, according to its disclosure post as summarized by Meyer. Wiz says it found its first PHP vulnerability on Aug. 19 using its Wiz Atlas platform along with Gemini 4 Argon and GPT-5.6 Sol. It reported unauthenticated code execution against Drupal on Aug. 20 and WordPress on Aug. 21, then reported the issue to PHP on Aug. 24. The account says Calif and Wiz reached the same class of flaw independently within weeks; the precise relationship between their findings and the two CVE identifiers is not fully detailed.

The research credit, as set out in the source, goes to Calif, OpenAI and Wiz, with fixes made by the PHP security team. The source identifies Calif researcher Ryan Austin as the author of its research and says its work formed part of OpenAI’s Patch the Planet initiative. Meyer also credits Wiz’s use of Google’s model, but the available material does not establish that AI systems acted without researcher direction.

Why PHP Memory Limits Matter

PHP powers a large share of websites, so remote code execution flaws in the runtime can have consequences beyond a single application. If an attacker can cause code to run on a server through a vulnerable PHP process, the risk may extend to sites and services hosted there. The source calls the vulnerabilities critical, but does not provide enough technical detail to describe the conditions required for exploitation or the full set of affected systems.

The timeline also illustrates a practical point about AI-assisted security research: tools may help search, test and validate a researcher’s theory, but the account credits people with choosing the target and drawing on historical knowledge. Austin’s conclusion, quoted in the source, cautions against treating models as automatic bug-finding systems. For maintainers, the immediate concern is to apply PHP’s fixes; for security teams, the longer-term lesson is that old reports and unresolved questions can remain relevant as software and review methods change.

From the 2004 Advisory to PHP2Shell

In July 2004, security researcher Stefan Esser published Bugtraq Advisory 11/2004, titled “PHP memory_limit remote vulnerability.” As quoted in Meyer’s account, Esser warned that a remote attacker could trigger memory-limit termination “in places where an interruption is unsafe,” potentially allowing code execution. PHP addressed the specific paths described at the time. The broader concern was that abruptly stopping a request during an operation could leave partially prepared structures for cleanup code to handle.

A later issue supplied another clue. On Nov. 28, 2019, PHP bug tracker report #78876 described oversized multipart form fields causing an out-of-memory condition and leaving temporary files behind. PHP fixed it in May 2020, and the issue received CVE-2019-11048 as a denial-of-service vulnerability. Calif’s account interprets the leftover files as evidence worth revisiting, but that interpretation should not be confused with proof that the 2019 issue enabled remote code execution.

In 2024, Quarkslab audited PHP with the Open Source Technology Improvement Fund and the PHP Foundation. Meyer reports that the published audit listed 27 findings and four CVEs, all resolved; he says the public OSTIF summary did not mention an out-of-memory issue. Calif says the auditors rediscovered one but could not prove exploitation. That claim is attributed to Calif and is not independently established by the audit summary described in the source.

“Possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.”

— Stefan Esser, in PHP Advisory 11/2004, as quoted by Thorsten Meyer

What the Disclosures Do Not Establish

The source does not specify which PHP versions were affected, which versions contain the fixes, or whether the two CVEs map one-to-one to Calif’s and Wiz’s findings. It also does not include technical descriptions of the vulnerable code or the full conditions needed to reproduce the reported remote code execution. Those details matter for assessing exposure, but should not be inferred from the timeline alone.

Some parts of the historical account rely on statements by Calif or the research teams. In particular, Calif’s assertion that an out-of-memory issue reappeared during the 2024 audit is not reflected in the OSTIF summary as described by Meyer, and the source says exploitation was not proven at that time. The timeline also does not fully explain how the researchers’ findings were coordinated with PHP or how the final patches address the older concern.

Patch Status and Disclosure Details

PHP has shipped fixes, and operators should consult the PHP security advisories and release notes to identify affected versions and the appropriate patched releases. The source’s account does not list version numbers, so administrators should verify their own deployments against PHP’s official notices rather than rely on the historical narrative alone. The source also points readers to a separate patch-and-restart guide, but that guide is not included here.

Further clarity would come from PHP’s technical advisories, including the affected branches, remediation details and any guidance for applications using PHP through frameworks or hosting providers. The research teams’ full disclosures may also clarify how the two CVEs relate to their separate findings and what role each AI system played. Until those details are available in the cited material, the confirmed development is limited to the release of fixes and the teams’ reported research timelines.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used in the source for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, for which PHP shipped fixes on Oct. 21, 2026.

Did AI discover the vulnerabilities on its own?

The supplied account does not support that conclusion. It describes AI tools used in research led by people: Calif’s Ryan Austin selected the target and drew on PHP vulnerability history, while Wiz says it used its platform with Gemini 4 Argon and GPT-5.6 Sol.

What is the connection to the 2004 warning?

Stefan Esser’s 2004 advisory warned that PHP’s memory-limit termination could occur at an unsafe point in request handling. The 2026 timeline revisits that general concern, but the source does not establish that the new vulnerabilities are simply the same bugs reported in 2004.

How can PHP operators check whether they need to update?

Operators should check PHP’s official security advisories and release notes for affected versions and the fixed releases. The source provided here does not list those version numbers.

Source: ThorstenMeyerAI.com